On 11/5/2010 8:38 PM, Jason Edgecombe wrote: > hi, > > I would like to bring up the topic of security for the gerrit > auto-builds. Currently, anyone in the world may submit code to gerrit > and that will be built by the buildslaves with no extra approvals needed > and no questions asked. > > Do we want to continue with this arrangement?
Absolutely not.
>
> When this was last discussed, a flag in gerrit was mentioned, but no
> action has been taken to my knowledge.
What we would prefer is that patchsets be built only when the following
conditions are met:
1. the "Committer" is on a trusted list or a member of the
trusted list has given a positive "Code Review"
2. the submission is the most recent patchset for the issue.
(if a series of patchsets have been submitted to gerrit before
the build slaves can get to them, those that are out of date
should be skipped and builds in progress should be canceled)
Jeffrey Altman
signature.asc
Description: OpenPGP digital signature
